160 lines
4.9 KiB
Plaintext
160 lines
4.9 KiB
Plaintext
--------------------------
|
|
Mod Defender for HAProxy
|
|
--------------------------
|
|
|
|
|
|
This is a service that talks SPOE protocol and uses the Mod Defender
|
|
(https://github.com/VultureProject/mod_defender) functionality to detect
|
|
HTTP attacks. It returns a HTTP status code to indicate whether the request
|
|
is suspicious or not, based on NAXSI rules. The value of the returned code
|
|
can be used in HAProxy rules to determine if the HTTP request should be
|
|
blocked/rejected.
|
|
|
|
Unlike ModSecurity, Mod Defender is a whitelist based WAF (everything is
|
|
disallowed, unless there are rules saying otherwise). It's a partial
|
|
replication of NAXSI and it uses NAXSI compatible rules configuration
|
|
format.
|
|
|
|
|
|
1) How to build it
|
|
------------------
|
|
|
|
Required packages :
|
|
|
|
* Mod Defender source (https://github.com/VultureProject/mod_defender)
|
|
* Asynchronous event notification library and headers (libevent)
|
|
* Apache 2 (>= 2.4) development headers
|
|
* APR library and headers
|
|
* GNU C (gcc) and C++ (g++) >= 4.9
|
|
* GNU Standard C++ Library v3 (libstdc++)
|
|
* GNU Make
|
|
|
|
|
|
Compile the source :
|
|
|
|
$ make MOD_DEFENDER_SRC=/path/to/mod_defender_src
|
|
|
|
|
|
2) Configuration
|
|
----------------
|
|
|
|
Download the Naxsi core rules file :
|
|
|
|
$ wget -O /path/to/core.rules \
|
|
https://raw.githubusercontent.com/nbs-system/naxsi/master/naxsi_config/naxsi_core.rules
|
|
|
|
|
|
Create the Mod Defender configuration file. For example :
|
|
|
|
# Defender toggle
|
|
Defender On
|
|
# Match log path
|
|
MatchLog /path/to/defender_match.log
|
|
# JSON Match log path
|
|
JSONMatchLog /path/to/defender_json_match.log
|
|
# Request body limit
|
|
RequestBodyLimit 8388608
|
|
# Learning mode toggle
|
|
LearningMode Off
|
|
# Extensive Learning log toggle
|
|
ExtensiveLog Off
|
|
# Libinjection SQL toggle
|
|
LibinjectionSQL On
|
|
# Libinjection XSS toggle
|
|
LibinjectionXSS On
|
|
|
|
# Rules
|
|
Include /path/to/core.rules
|
|
|
|
# Score action
|
|
CheckRule "$SQL >= 8" BLOCK
|
|
CheckRule "$RFI >= 8" BLOCK
|
|
CheckRule "$TRAVERSAL >= 4" BLOCK
|
|
CheckRule "$EVADE >= 4" BLOCK
|
|
CheckRule "$XSS >= 8" BLOCK
|
|
CheckRule "$UPLOAD >= 8" BLOCK
|
|
|
|
# Whitelists
|
|
# ....
|
|
|
|
|
|
Next step is to configure the SPOE for use with the Mod Defender service.
|
|
Example configuration (args elements order is important) :
|
|
|
|
[mod_defender]
|
|
|
|
spoe-agent mod-defender-agent
|
|
messages check-request
|
|
option var-prefix defender
|
|
timeout hello 100ms
|
|
timeout idle 30s
|
|
timeout processing 15ms
|
|
use-backend spoe-mod-defender
|
|
|
|
spoe-message check-request
|
|
args src unique-id method path query req.ver req.hdrs_bin req.body
|
|
event on-frontend-http-request
|
|
|
|
|
|
The engine is in the scope "mod_defender". To enable it, you must set the
|
|
following line in a frontend/listener section :
|
|
|
|
frontend my_frontend
|
|
...
|
|
filter spoe engine mod_defender config /path/to/spoe-mod-defender.conf
|
|
...
|
|
|
|
|
|
Also, we must define the "spoe-mod-defender" backend in HAProxy configuration :
|
|
|
|
backend spoe-mod-defender
|
|
mode tcp
|
|
balance roundrobin
|
|
timeout connect 5s
|
|
timeout server 3m
|
|
server defender1 127.0.0.1:12345
|
|
|
|
|
|
The Mod Defender status is returned in a variable "sess.defender.status" --
|
|
it contains the returned HTTP status code. The request is considered
|
|
malicious if the variable contains value greater than zero.
|
|
|
|
The following rule can be used to reject all suspicious HTTP requests :
|
|
|
|
http-request deny if { var(sess.defender.status) -m int gt 0 }
|
|
|
|
|
|
3) Start the service
|
|
--------------------
|
|
|
|
To start the service, you need to use "defender" binary :
|
|
|
|
$ ./defender -h
|
|
Usage : ./defender [OPTION]...
|
|
-h Print this message
|
|
-f <config-file> Mod Defender configuration file
|
|
-l <log-file> Mod Defender log file
|
|
-d Enable the debug mode
|
|
-m <max-frame-size> Specify the maximum frame size (default : 16384)
|
|
-p <port> Specify the port to listen on (default : 12345)
|
|
-n <num-workers> Specify the number of workers (default : 10)
|
|
-c <capability> Enable the support of the specified capability
|
|
-t <time> Set a delay to process a message (default: 0)
|
|
The value is specified in milliseconds by default,
|
|
but can be in any other unit if the number is suffixed
|
|
by a unit (us, ms, s)
|
|
|
|
Supported capabilities: fragmentation, pipelining, async
|
|
|
|
Example:
|
|
|
|
$ ./defender -n 4 -f /path/to/mod_defender.conf -d -l /path/to/error.log
|
|
|
|
|
|
4) Known bugs and limitations
|
|
-----------------------------
|
|
|
|
In its current state, the module is limited by haproxy to the analysis of
|
|
the first buffer. One workaround may consist in significantly increasing
|
|
haproxy's buffer size.
|